aFreeRDP: Heap OOB Read in Graphics Pipeline via Unvalidated mappedWidth/mappedHeight (Android Client)

Impact

Out of bounds read when using window mapped GFX surfaces. Only the android client is affected.

Details

When a surface is windowMapped via RDPGFX_MAP_SURFACE_TO_WINDOW_PDU, the server supplies mappedWidth and mappedHeight values (UINT32) that are stored in the gdiGfxSurface structure with no validation against the actual surface buffer dimensions:

    surface->mappedWidth = surfaceToWindow->mappedWidth;   // no bounds check

    surface->mappedHeight = surfaceToWindow->mappedHeight;  // no bounds check

In the Android client's android_UpdateWindowFromSurface, these unvalidated values control the pixel copy region:

    freerdp_image_copy((BYTE*)dst, ..., width, height,

            surface->data, ..., surface->scanline, ...);

If mappedWidth > surface->width or mappedHeight > surface->height, freerdp_image_copy reads beyond the heap allocation. The WINPR_ASSERT guard in freerdp_image_copy compiles to a no-op in release builds (NDEBUG defined).

Workarounds

Do not use GFX

Credits

Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon

DREAM Security Research Team